Escape HTML in the cors.rs documentation.

Rustdoc passes the code straight through, leading to poor generated HTML.
Merge pull request #2923 from Ms2ger/cors-escape

Escape HTML in the cors.rs documentation.